Method, System, and Computer Program Product for Blocking Malicious Program Behaviors

1. A method for blocking keystroke logging on a first computer system, the method comprising: executing first program on the first computer system, wherein the first program executes to monitor the first computer system to detect keystroke logging behavior; the first program automatically initiating monitoring of the first computer system to detect keystroke logging behavior in response to detecting initiation of network communication between the first computer system and a second computer system; the first program detecting keystroke logging behavior of a second program executing on the first computer system; and the first program blocking the keystroke logging behavior of the second program.

2. The method of claim 1 , further comprising: the first program detecting a condition indicating that the monitoring of the first computer system to detect keystroke logging behavior should be terminated; and the first program automatically terminating the monitoring of the first computer system to detect keystroke logging behavior in response to said detecting the condition.

3. The method of claim 1 , further comprising: the first program detecting that the network communication between the first computer system and the second computer system has ended; and the first program automatically terminating the monitoring of the first computer system to detect keystroke logging behavior in response to said detecting that the network communication has ended.

4. The method of claim 1 , wherein said detecting the initiation of the network communication between the first computer system and the second computer system comprises detecting initiation of an online transaction between the first computer system and the second computer system.

5. The method of claim 4 , further comprising: the first program detecting that the online transaction between the first computer system and the second computer system has ended; and the first program automatically terminating the monitoring of the first computer system to detect keystroke logging behavior in response to said detecting that the online transaction has ended.

6. The method of claim 4 , wherein said detecting the initiation of the online transaction between the first computer system and the second computer system comprises one or more of: detecting initiation of a web-based transaction between the first computer system and the second computer system; detecting initiation of a browser session between the first computer system and the second computer system; and/or detecting that the first computer system has begun a transaction with a website hosted by the second computer system.

7. The method of claim 4 , wherein said detecting the initiation of the online transaction between the first computer system and the second computer system comprises detecting initiation of a virtual private network (VPN) session between the first computer system and the second computer system.

8. The method of claim 1 , wherein said blocking the keystroke logging behavior of the second program comprises automatically blocking the keystroke logging behavior of the second program in response to said detecting the keystroke logging behavior of the second program.

9. The method of claim 1 , further comprising: the first program displaying a graphical user interface on the first computer system, wherein the graphical user interface enables a user to select a response to said detecting the keystroke logging behavior of the second program; and the first program receiving user input selecting a blocking response via the graphical user interface; wherein said blocking the keystroke logging behavior of the second program comprises blocking the keystroke logging behavior of the second program in response to the user input selecting the blocking response.

10. A non-transitory computer-accessible storage medium storing first program instructions of a first program, wherein the first program instructions are executable by a first computer system to: automatically initiate monitoring of the first computer system to detect keystroke logging behavior in response to detecting initiation of network communication between the first computer system and a second computer system; detect keystroke logging behavior of a second program executing on the first computer system; and block the keystroke logging behavior of the second program.

11. The non-transitory computer-accessible storage medium of claim 10 , wherein the first program instructions are further executable by the first computer system to: detect a condition indicating that the monitoring of the first computer system to detect keystroke logging behavior should be terminated; and automatically terminate the monitoring of the first computer system to detect keystroke logging behavior in response to detecting the second condition.

12. The non-transitory computer-accessible storage medium of claim 10 , wherein the first program instructions are further executable by the first computer system to: detect that the network communication between the first computer system and the second computer system has ended; and automatically terminate the monitoring of the first computer system to detect keystroke logging behavior in response to said detecting that the network communication has ended.

13. A first computer system comprising: one or more processors; and memory storing a first program and a second program; wherein the first program is executable by the one or more processors to: automatically initiate monitoring of the first computer system to detect keystroke logging behavior in response to detecting initiation of network communication between the first computer system and a second computer system; detect keystroke logging behavior of the second program; and block the keystroke logging behavior of the second program.

14. The first computer system of claim 13 , wherein the first program is further executable by the first computer system to: detect a condition indicating that the monitoring of the first computer system to detect keystroke logging behavior should be terminated; and automatically terminate the monitoring of the first computer system to detect keystroke logging behavior in response to detecting the condition.

15. The first computer system of claim 13 , wherein the first program is further executable by the first computer system to: detect that the network communication between the first computer system and the second computer system has ended; and automatically terminate the monitoring of the first computer system to detect keystroke logging behavior in response to said detecting that the network communication has ended.